Analysis
The AI Agent Question SR 26-2 Leaves Your Bank to Answer
Publication date not yet evaluated · Added curity.io
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Agentic AI in banking raises the risk of over-permissioned autonomous agents taking unauthorized actions (like moving funds), so defenders need explicit authorization, least privilege, and rapid revocation controls to trace and contain compromised agents.
Curity's blog discusses how banks should handle authorization and identity for agentic AI following SR 26-2, the April 2026 Federal Reserve/OCC/FDIC guidance that excludes generative and agentic AI from model risk management rules while leaving governance to institutions. It argues that common shortcuts—long-lived service accounts or handing agents a user's own token—obscure which agent acted under whose authority, and advocates zero-trust, task-scoped delegation with fast revocation for compromised agents.